Bioshock PC Game - Can NOD32 remove the rootkit?

[Xophile]

Hi!

I guess many people besides me have heard about all the issues with the recently released Bioshock game. Apparently it comes with SecuROM copyprotection which adds a rootkit on your system.

Is NOD32 capable of discover/remove this?

I downloaded and installed the demo yesterday but so far NOD hasn't reacted.

Links:

http://forums.2kgames.com/forums/showthread.php?t=5993
http://consumerist.com/consumer/puni...day-292841.php

[b00ze]

Usually rootkis are hidden and dont tell you that you have to reboot or deinstall something (a virtual drive like alcohol 120% as an example). You have three options: dont buy it, dont install it, dont play it.

[YeOldeStonecat]

I think rootkits are a gray area, certainly an entirely different debate.

Securom is from a legit company, it doesn't have a malicious intent, it's part of the game. It's also visible to Windows...it does install a service. I think true rootkits are entirely hidden from the OS. I think the jury is out as to if Securom is indeed a rootkit...Google it and Bioshock and you'll see forums debating the subject.

Rootkits as a technology certainly can have malicious intents, and be dangerous if used in such a manner.

Sooo...question is...does/should NOD32 detect ALL rootkits...regardless if legit software.

[Brian N]

Only AVG stops it from installing which I find pretty funny. Nothing else detects it.

[Itsme]

Originally Posted by YeOldeStonecat

I think rootkits are a gray area, certainly an entirely different debate.

Sooo...question is...does/should NOD32 detect ALL rootkits...regardless if legit software.

Yes, I think it should detect it, and then ask us if we allow it or have it removed (and keep track of the decisions in a exclusion/inclusion list).

Kind regards
Itsme

[YeOldeStonecat]

I spent a little more time hunting/googling Securom.....it appears that media frenzy has it hyped up to be mislabeled as a rootkit, and some of the better, more technical/accurate forums are indeed stating that it is not a rootkit. Including a Microsoft tech forum..where a moderator there is stating that it is not a rootkit.

The fact that is does create a service on your computer which you can easily see in services.msc (it's NOT hidden) leads me to believe it's not a rootkit either. AFAIK...Rootkits by definition, are supposed to be totally hidden.

[NOD32 user]

Originally Posted by YeOldeStonecat

I spent a little more time hunting/googling Securom.....it appears that media frenzy has it hyped up to be mislabeled as a rootkit, and some of the better, more technical/accurate forums are indeed stating that it is not a rootkit. Including a Microsoft tech forum..where a moderator there is stating that it is not a rootkit.

The fact that is does create a service on your computer which you can easily see in services.msc (it's NOT hidden) leads me to believe it's not a rootkit either. AFAIK...Rootkits by definition, are supposed to be totally hidden.

So it could easily be a PUA then by the sound of it?

Cheers

[lucas1985]

Originally Posted by YeOldeStonecat

AFAIK...Rootkits by definition, are supposed to be totally hidden.

There are varing levels of "stealthness" (is that a correct word?) in the rootkit field.

Originally Posted by NOD32 user

So it could easily be a PUA then by the sound of it?

I agree

[Supersnake]

Originally Posted by YeOldeStonecat

The fact that is does create a service on your computer which you can easily see in services.msc (it's NOT hidden) leads me to believe it's not a rootkit either. AFAIK...Rootkits by definition, are supposed to be totally hidden.

What is the name of the service please?

[mata7]

just dont buy it, dont support any PC Game wiht that kind of protection, get a Console and you will have you pc clean of crap like this one

[lucas1985]

Originally Posted by Supersnake

What is the name of the service please?

Some info on SecuROM.

[Supersnake]

Originally Posted by lucas1985

Some info on SecuROM.

Thanks Lucas, within that wiki article reads:

Latest SecuROM Versions are all 7.x versions which are released and updated continuously. SecuROM 7.x installs its own service to user's computer UAService7.exe — (ring 3), which works in ring 3 of the computer's operating system.

[Firecat]

I don't think NOD32 or many other AVs are going to add detection for this for various legal reasons. I am, however, surprised to hear that AVG of all the vendors is detecting it....

[YeOldeStonecat]

Originally Posted by lucas1985

Some info on SecuROM.

Anything from Wikipedia should be taken with a grain of salt....anyone can contribute to it, leading to often mis-tinfoil hatted-information.

[RealBig]

Well I managed to get myself infected with a very nasty trojan whilst messing with Bioshock. Here's a link that contains the symptoms and how to remove.

http://kb.mozillazine.org/Firefox.exe_always_open

The only application that I was able to find that located the culprit (regedt.exe file in windows/system32 which was hidden in the explorer, notice the file name) was ADS Spy. This neat little program is able to locate hidden data streams that AV software and regular trojan scanners cannot find. A registry key is also created.

I've also heard that AVG is able to locate and remove this, but NOD didn't. Does anyone have any tips or suggestions on highly reliable Trojan Scanners ? I tried Trojan Hunter, but it missed this nasty little beast.

[FRug]

Good heavens that idiocy about a rootkit originated from a blog by a clueless guy who tried to get more attetion to his blog by using the term "rootkit" for a registry key that was hidden because of a "*" in the key name. He removed the term Rootkit after being subjected to a thorough bashing by commenters both on his blog and slashdot. Too late for some news sites / bloggers / forums to notice, which means this FUD continues to get spread.

There is NO rootkit in there. Don't believe every FUD bloggers post and random news sites pick up without checking the facts.

It does contain some really stupid copy protection, but nothing of it resembles a rootkit. The copy protection service is neither hidden nor does it try to prevent deactivation or uninstallation.

The correct news would be: Securom copy protection software has a registry key that cannot be deleted because of a special character. No rootkit, no malware, no nothing.


/me crawls away to play some more BioShock, which is an awesome game